Fallos del tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2022-45155MEDIUMobs-service-go_modules: arbitrary directory deleteEPSS 0.2%CVE-2026-23762MEDIUMVB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCacheEPSS 0.2%CVE-2021-29619LOWSegfault in `tf.raw_ops.SparseCountSparseOutput`EPSS 0.2%CVE-2023-28114MEDIUM`cilium-cli` disables etcd authorization for clustermesh clustersEPSS 0.2%CVE-2022-25917MEDIUMUncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to poEPSS 0.2%CVE-2025-30652MEDIUMJunos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crashEPSS 0.2%CVE-2024-51766MEDIUMHPE NonStop DISK UTIL, Local Denial of Service vulnerabilityEPSS 0.2%CVE-2024-37284MEDIUMElastic Defend Improper Handling of Alternate Encoding Leads to CrashEPSS 0.2%CVE-2023-46297MEDIUMAn issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices. A WAN attacker can make the admin interface unreachablEPSS 0.2%CVE-2025-21596MEDIUMJunos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crashEPSS 0.2%CVE-2025-46733HIGHREE userspace code can panic TAs, leading to fTPM PCR reset and data disclosureEPSS 0.1%CVE-2022-20414MEDIUMIn setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. This could leEPSS 0.1%CVE-2022-20500MEDIUMIn loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of sEPSS 0.1%CVE-2023-43686MEDIUMAn issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). A large number of Firefox preference files can cause EPSS 0.1%CVE-2026-16730MEDIUMDbus-broker: dbus-broker: session bus denial of service via emfile during peer setupEPSS 0.1%CVE-2026-54578LOWmport verify can compare stale checksum data after hashing failuresEPSS 0.1%CVE-2021-25474MEDIUMAssuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-20EPSS 0.1%CVE-2021-25473MEDIUMAssuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR OcEPSS 0.1%CVE-2023-20993HIGHIn multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception. This could lead toEPSS 0.1%CVE-2025-54634HIGHVulnerability of improper processing of abnormal conditions in huge page separation. Impact: Successful exploitation of this vulnerability mEPSS 0.1%